Privacy Policy

1. General

affilink ("the Service", "we", "the Platform") is an affiliate marketing platform that lets businesses launch and manage affiliate programs, and lets affiliates promote offers and earn a commission. We respect your privacy and are committed to protecting the personal data you provide. This policy explains what information we collect, how we use it, who we share it with, and what rights you have. This policy is aligned with the Israeli Privacy Protection Law, 5741-1981, including Amendment No. 13 to the Law.

Using the Service constitutes acceptance of this policy.

2. Who we are and our Data Protection Officer

The Service is operated by Eyal Meshulam (VAT-exempt dealer), dealer no. 034162560, of 57 HaTichon St., Haifa (the "Operator"). The Operator is the Controller of the personal data processed through the Service.

Data Protection Officer (DPO): We have appointed a Data Protection Officer, Eyal Meshulam, responsible for implementing this policy and handling privacy-related requests. You may contact the DPO directly at dpo@affilink.co.il.

3. What information we collect

Information you provide to us

Account details: name, email address and password on registration. If you sign up with Google, we receive your name and email from your Google account.
Organization details: business name, details of team members you invite, and the settings of offers you create.
Billing and payment details: when you purchase a subscription, payment takes place on a secure Green Invoice / morning payment page, and billing details are processed by them and by the clearing provider behind them. We do not store card details on our servers, and we never see them.
Affiliate payout details: details required to pay commissions (e.g. bank account or payment method), as provided for settlement.
Content you generate: tracking links, campaign settings and support requests.

Information collected automatically

Details of a store applying to join affilink's network: the store name, website, a contact person's name, phone and email, and, if given, its legal name and business or company number. They are used to review the application, to stay in touch with the store and to issue its monthly statements.
Affiliate tracking data (Server-to-Server): clicks and conversions reported through our tracking system, including click identifiers, IP address (stored as a one-way hash), device type and referring page, plus an approximate city-level location (coordinates rounded to about 10 km) and time zone as provided by Cloudflare. The approximate location is used only to determine whether a sale was made on Shabbat or a Jewish holiday where the buyer is (see section 6 of the terms). This data is essential to the Service's core function - conversion attribution and commission payment.
Usage and analytics data: IP address, browser type, pages viewed and access times - collected via Google Analytics by default, unless you chose otherwise (see the cookies section).
Cookies and local storage: for session management, theme preference and security.

4. How we use the information

To provide and operate the Service - registration, account management, link generation and conversion attribution.
To calculate, report and pay commissions and manage subscription billing.
To determine whether a sale was made on Shabbat or a Jewish holiday where the buyer is, so we can honor an affiliate's choice not to earn commissions on such sales and our own waiver of platform fees on them, and show a "closed for Shabbat" page for a store that asked for one.
To secure the platform, prevent fraud and detect abuse.
To improve the Service and analyze usage patterns (in aggregate).
To communicate with you - operational updates, support and service notices.
To comply with legal obligations (e.g. accounting and tax).

5. Legal basis for processing and Amendment 13

We process personal data on one or more of the following bases: performance of our contract with you (providing the Service), your consent, legitimate interest (security, fraud prevention and service improvement), and legal obligation. Processing is carried out in accordance with the Privacy Protection Law, 5741-1981, including Amendment No. 13 and its regulations.

Consequences of withholding consent: providing some information is essential to operate the Service (e.g. account details and conversion attribution) - without it we cannot provide the Service or parts of it. Providing other information (e.g. consent to marketing) is optional, and withholding it will not affect your ability to use the Service.

We do not sell personal data. We share information only in the following cases:

Service providers (data processors): Cloudflare (hosting and infrastructure), Google (authentication, and Analytics unless you opted out), and Green Invoice / morning (issuing invoices and receipts, and clearing payment for the subscription and platform fees) - each only to the extent required for its role.
Resend (email delivery): to send you updates about activity in your account (for example an approved join request, a request waiting for you, or a team invitation), it receives your email address and the message content.
The Hebcal.com calendar service: to obtain Shabbat and holiday times, our servers send it only a rounded (city-level) location and a time zone - no name, no click identifier and not your IP address.
Between parties to a transaction: a business and an affiliate sharing a conversion will see the data required to settle between them (e.g. conversion volume and commissions), but not personal details beyond what is necessary.
As required by law: where required by law, court order, or to protect our rights.

7. Direct marketing communications

Subject to your consent, we may send you promotional material and marketing updates by email, SMS or other means, in accordance with the Communications Law (Telecommunications and Broadcasting), 5742-1982. You may withdraw your consent and stop receiving promotional material at any time, via the opt-out mechanism in each message or by contacting us. Service messages essential to operating your account (verification, billing, security alerts) may be sent even without marketing consent.

8. Automated decisions and profiling

For security and fraud prevention, we may analyze click and conversion patterns and apply automated checks to detect anomalous activity. We do not make decisions based solely on automated processing that produce legal effects or similarly significant effects on you without the possibility of human review. If you believe a particular decision was made unlawfully, you may contact us for reconsideration.

Whether a sale was made on Shabbat or a holiday is determined automatically, from the calendar and the click's approximate location, and it affects a commission only for an affiliate who chose this themselves. If the calendar is unavailable at that moment, the sale is treated as a Shabbat sale. An affiliate who believes a sale was classified this way by mistake may contact us, and we will review it manually.

9. Cookies and tracking technologies

We use essential cookies (authentication and security) and preference cookies (theme), which are always active. In addition, by default the site uses cookies to operate and for statistics: the Google Analytics tool, for aggregate measurement of how the site is used. A notice about this appears on your first visit. You can choose otherwise at any time, here below or via the "Cookie settings" link at the bottom of every page:

All cookies (default): essential cookies, preference cookies and Google Analytics.
Necessary cookies only: Google Analytics is not loaded and no data is sent to it, and analytics cookies already stored are deleted. Choosing this after the tool has loaded reloads the page so that it actually stops running.
No cookies at all: like "necessary only", and in addition the site deletes on every visit every cookie the browser lets it delete. Protected authentication cookies remain while you are signed in.

Your choice is stored in your browser's local storage (localStorage) on your device. Clearing site data restores the default. Full details appear in our Cookie Policy.

10. Children's privacy

The Service is intended for users aged 18 and over and for corporations, and is not directed at minors. We do not knowingly collect personal data from minors. If you become aware that a minor has provided us with information, please contact us and we will act to delete it.

11. How long we keep the information

We retain personal data for as long as your account is active, and for an additional period as required to meet legal obligations (e.g. retaining accounting records under tax law), resolve disputes and enforce agreements. When an account is deleted, we delete or anonymize data we no longer need to retain.

12. Data security

We apply reasonable technical and organizational measures to protect the information, including encryption in transit (HTTPS), HMAC signatures on conversion reports, role-based access control, and encrypted secret management. However, no system is entirely immune, and we cannot guarantee absolute security.

13. Security incidents and notification

We monitor our systems to detect security incidents. In the event of a serious security incident affecting personal data, we will act in accordance with our legal obligations - including notifying the Privacy Protection Authority and the relevant data subjects as required, covering the nature of the incident, its scope and the steps taken to mitigate harm.

14. Your rights

Subject to applicable law, you have the following rights:

Access: to receive information about data held about you.
Rectification: to request correction of inaccurate or outdated information.
Erasure: to request deletion of information, subject to exceptions in law.
Restriction and objection: to object to certain processing, including marketing.

To exercise your rights, contact the Data Protection Officer at dpo@affilink.co.il. We will respond within a reasonable time and in accordance with the law. You also have the right to lodge a complaint with the Privacy Protection Authority.

15. International data transfers

Some of our service providers (e.g. Cloudflare, Google and Resend, as well as Hebcal.com, which receives only a rounded location) process data on servers outside Israel. Such transfers are carried out in accordance with the Privacy Protection Regulations (Transfer of Data to Databases Abroad) and subject to the providers' commitment to an adequate level of protection.

16. Changes to this policy

We may update this policy from time to time. The current version will be published on this page with an updated date. A material change will be brought to your attention by reasonable means.

17. Contact

For any question or request regarding your privacy and personal data, you may contact our Data Protection Officer, Eyal Meshulam, at dpo@affilink.co.il.